|
(11) | EP 3 424 195 B1 |
| (12) | EUROPEAN PATENT SPECIFICATION |
|
|
| (54) |
ENCRYPTED PASSWORD TRANSPORT ACROSS UNTRUSTED CLOUD NETWORK TRANSPORT VERSCHLÜSSELTER PASSWÖRTER ÜBER EIN UNSICHERES CLOUD-NETZWERK TRANSPORT DE MOT DE PASSE CRYPTÉ À TRAVERS UN RÉSEAU NUAGIQUE NON SÉCURISÉ |
|
|
|||||||||||||||||||||||||||||||
| Note: Within nine months from the publication of the mention of the grant of the European patent, any person may give notice to the European Patent Office of opposition to the European patent granted. Notice of opposition shall be filed in a written reasoned statement. It shall not be deemed to have been filed until the opposition fee has been paid. (Art. 99(1) European Patent Convention). |
BACKGROUND
[0002] US 2014/331060 discloses a technique for authenticating users of client devices to allow access of resources and services in enterprise systems. US 2015/012751 discloses secure communication of authentication information in a networked environment.
SUMMARY
[0003] Customers of cloud services want to ensure that sensitive data such as user passwords are not accessible to the cloud services they use. However, traditional user authentication methods (such as SAML and OAuth) may have limitations if used with certain remote-access services, such as the XenApp™ and XenDesktop™ products of Citrix Systems Inc., as the desktop operating system (e.g., Windows) may require the plaintext password to create a user session.
[0004] The presently disclosed technique can provide a secure solution to encrypt the password at the client web browser before it flows through the cloud. It thus can ensure that the plaintext password and the private key required for decryption do not flow through the cloud. The password can only be decrypted by the on-premises (enterprise network) servers that possess the private key to perform a login.
[0005] More particularly, a method is disclosed of operating a computer in an untrusted cloud computing network as a cloud-based enterprise application store via which a client computer establishes a connection to an enterprise application executing in a trusted computing network.
[0006] The invention provides a method according to claim 1. The invention also provides a method according to claim 6. The invention provides a special-purpose computer according to claim 11. The invention also provides a special-purpose computer according to claim 13.
[0007] A described method includes, in a login phase, performing a first user authentication for a user of the client computer and receiving security identifiers from the trusted computing network, the security identifiers identifying the user as an authorized user of the trusted computing network. The first user authentication includes (1) transmitting a public key of a private/public key pair of the trusted computing network to the client computer and (2) subsequently receiving from the client computer and transmitting to the trusted computing network an encrypted password and encrypted key, the encrypted password being a user password encrypted under a first one-use symmetric key, the encrypted key being the first one-use symmetric key encrypted under the public key. The trusted computing network decrypts the encrypted key and the encrypted password to obtain the user password for authenticating the user and returning the security identifiers to the enterprise application store.
[0008] The described method further includes, in a subsequent application launch phase, performing a second user authentication as part of establishing the connection to the enterprise application. The second user authentication includes (1) transmitting the encrypted password and encrypted key to the trusted computing network and (2) subsequently receiving from the trusted computing network and transmitting to the client computer a login ticket, the login ticket including a second one-use symmetric key under which the user password is encrypted and stored in encrypted form within the trusted computing network. The client computer subsequently transmits a connection-establishment message including the login ticket to the trusted computing network, the trusted computing network decrypting the encrypted form using the second one-use symmetric key from the login ticket of the connection-establishment message to obtain the user password for authenticating the user and establishing the connection of the client computer to the enterprise application.
[0009] In particular embodiments, the connection of the client computer to the enterprise application is via a remote desktop session delivered by a virtual desktop agent of the enterprise network, and wherein the connection-establishment message is a request from the client computer for the virtual desktop agent to initiate the remote desktop session.
[0010] In particular embodiments, the trusted computing network includes a cloud interface server and one or more application/services servers, the application/services servers hosting the enterprise application, the cloud interface server providing a local interface to the enterprise application store, and wherein the private/public key pair of the trusted computing network is a private/public key pair of the cloud interface server.
[0011] In particular embodiments, the second one-use symmetric key is in encrypted form in the login ticket, the encrypted form having been asymmetrically encrypted with a second public key of a second private/public key pair of the enterprise network so as to be securely transmitted in the cloud network and decrypted only within the enterprise network.
[0012] In particular embodiments, the second user authentication in the application launch phase includes obtaining a second login ticket from a ticket authority of the cloud network and transmitting the second login ticket to the client computer; and the connection-establishment message is transmitted to a gateway of the enterprise network which uses the second login ticket in an exchange with the ticket authority to obtain an address for a virtual desktop agent of the enterprise network to which the connection-establishment message is to be sent, and subsequently sends the connection-establishment message to the virtual desktop agent.
[0013] Also disclosed is a corresponding method by which a cloud services agent in the enterprise network operates, as well as special-purpose computers for use as the enterprise application store and cloud services agent.
[0014] The disclosed methods and apparatus can ensure that an encrypted password never flows back to the browser and only a one-time ticket is sent back to the client computer. The use of asymmetric encryption for the symmetric key ensures that the logon ticket travelling through the cloud services cannot be directly used to decrypt the re-encrypted password.
BRIEF DESCRIPTION OF THE DRAWINGS
[0015] The foregoing and other objects, features and advantages will be apparent from the following description of particular embodiments of the invention, as illustrated in the accompanying drawings in which like reference characters refer to the same parts throughout the different views.
Figure 1 is a block diagram of a computer system;
Figure 2 is a hardware block diagram of a computer;
Figure 3 is a functional block diagram of a client computer;
Figure 4 is a functional block diagram of cloud services servers;
Figure 5 is a functional block diagram of enterprise network servers;
Figures 6 and 7 are message flow diagrams depicting system-level operation;
Figures 8 and 9 are flow diagrams depicting operation of an enterprise application store and a cloud services agent respectively.
DETAILED DESCRIPTION
[0016] Figure 1 shows a distributed computing system having client computers 10 (one shown for simplicity), a cloud network 12 having cloud services servers 14, and an enterprise network 16 having cloud interface servers (CLOUD INTFC SVRs) 18 and applications/services servers (APPS/SVCs SVRs) 20. As shown, the client computer 10 includes a browser 22 or similar program enabling a user 24 to log in to remote services, and a remote-desktop engine (R-D ENGINE) 26 used to render a remotely delivered application or virtual desktop on a local display of the client computer 10.
[0017] In operation, the client computer 10 establishes connections to the enterprise network 16 in order to utilize applications or services provided therefrom, for example to establish remote desktop sessions via which enterprise applications (such as database applications, collaboration applications, analysis/simulation applications, etc.) are delivered. The enterprise applications execute on the application/services servers 20 and provide user interfaces (for input and output) over the remote desktop sessions. The cloud services servers 14 serve as off-premises components for facilitating such remote user access. The cloud network 12 is referred to herein as "untrusted" based on its separation from the more secure and "trusted" enterprise network 16. The cloud network 12 may be provided in part by a third-party cloud computing service provider, for example. One key aspect of operation is user authentication, in particular the need to securely handle sensitive information such as a user password that is necessarily transmitted through the cloud network 12 during a user authentication process. This aspect of operation is described in some detail below.
[0018] Figure 2 shows an example configuration of a physical computer such as the client computer 10 or one of the servers 14, 18 or 20 from a computer hardware perspective. The hardware includes one or more processors 30, memory 32, and interface circuitry 34 interconnected by data interconnections 36 such as one or more high-speed data buses. The interface circuitry 34 provides a hardware connection to a network (such as the cloud network 12 or enterprise network 16, Figure 1) and perhaps other external devices/connections (EXT DEVs). The processor(s) 30 with connected memory 32 may also be referred to as "processing circuitry" herein. There may also be local secondary storage 38 such as a local-attached disk drive or Flash drive. In operation, the memory 32 stores data and instructions of system software (e.g., operating system) and one or more application programs which are executed by the processor(s) 30 to cause the hardware to function in a software-defined manner. Thus the computer hardware executing instructions of a cloud services application, for example, can be referred to as a cloud services component. It will be understood that a collection of such components can all be realized and interact with each other as one or more sets of computer processing hardware executing different computer programs as generally known in the art. Further, the application software may be stored on a non-transitory computer-readable medium such as an optical or magnetic disk, Flash memory or other nonvolatile semiconductor memory, etc., from which it is retrieved for execution by the processing circuitry, as also generally known in the art.
[0019] Figure 3 shows the client computer 10. It includes a graphical user interface (GUI) 40 along with the browser 22 and remote desktop engine 26. These are software-implemented components such as generally described above and such as generally known in the art. The GUI 40 is typically part of an operating system such as the Windows® or MAC® operating systems. The browser 22 can be implemented as an enhanced version of a standard Web browser, e.g., Firefox® or Internet Explorer®, incorporating certain specific functionality as described more herein. The remote desktop engine 26 is a local component capable of rendering a remotely-delivered application or desktop on a display of the client computer 10. In one example the remote desktop engine 26 may incorporate HDX™ technology of Citrix Systems Inc.
[0020] In operation, the browser 22 and remote desktop engine 26 interact with the cloud network 12 and enterprise network 16 to authenticate the user 24 to the enterprise network 16 and enable the user 24 to obtain computing services therefrom. In the examples herein, the computing services include remote desktop sessions in which the user 24 interacts with a virtualized personal computer using a standard desktop paradigm. The remote desktop is executed by an application server 20 within the enterprise network 16, with communications (including desktop session establishment and tear-down communications) traversing the cloud network 12. As described more below, the browser 22 plays a role in both initial user authentication (e.g., at a time of network login) as well as initiation or "launch" of new remote desktop sessions or other applications. The browser 22 and remote desktop engine 26 also interact with the user 24 in ways described herein.
[0021] Figure 4 shows the cloud services servers 14. They include an enterprise application store (ENT APP STORE) 50, remote desktop delivery controller (R-D DELIVERY CTRLLR) 52, and a ticket authority (TICKET AUTH'Y) 54. The remote desktop delivery controller 52 is also referred to as a "desktop delivery controller" or DDC, and the ticket authority 54 is also referred to as a "secure ticket authority" or STA. The servers 14 also include a management server 56 providing for management of the cloud servers 14 by a management user 58.
[0022] In operation, the enterprise application store 50 serves as a cloud-based access point via which users 24 access applications/services provided by the enterprise network 16. Various specifics of its functionality are described below. In one embodiment it may be realized as an enhanced version of the StoreFront™ product of Citrix Systems Inc. Pertinent functionality of the DDC 52 and STA 54 is described below.
[0023] Figure 5 shows the servers 18, 20 of the enterprise network 16. Among the cloud interface servers 18 are a cloud services agent (CLOUD SVCS AGT) 60, a gateway 62, and a remote desktop (R-D) delivery agent 64. The cloud services agent 60 is also referred to as C-S AGT; the gateway 62 as a GW; and the remote desktop delivery agent 64 as a "virtual desktop agent" or VDA. The VDA does not expose itself for direct access from the client/cloud. All traffic is proxied through the GW. The applications and services servers 20 include a directory service (DIR SVC) 66 and applications (APPS) 68. As indicated, the directory services 66 may be referred to as an "active directory" or A-D.
[0024] Figures 6 and 7 are message-flow diagrams illustrating aspects of operation of the system of Figures 1-5. Figure 6 shows processing and messaging at a time of user login, also referred to as a "login phase". Figure 7 shows processing and messaging at a later time of launching an application or desktop, also referred to as an "application launching phase".
[0025] Referring to Figure 6, a user initiates a login by directing the browser 22 to the application store 50. The application store 50 looks up or otherwise obtains a first public key denoted pbK1. This is the public key of a private/public key pair for the cloud services agent 60, and will be used in an asymmetric encryption of a user password as described more below. One example of asymmetric encryption is RSA® encryption. The cloud services agent 60 may have previously registered its public key either directly with the application store 50 or with some other intermediary from which the application store 50 obtains it. After obtaining pbK1, the application store 50 returns a login form along with pbK1 to the browser 22.
[0026] The browser 22 displays the login form to the user, who enters his/her login credentials which include a user or account name along with a password (PW). These credentials have previously been established within the enterprise network 16, specifically at the A-D server 66. This password may also be referred to herein as the "clear text password" to distinguish it from encrypted versions that are used during communications as described below. In one embodiment, the browser 22 is responsible for encrypting the password before forwarding it into the cloud network 12 (an alternative approach is given below). To this end, the browser 22 generates a first symmetric key denoted sK1 as well as a first initialization vector IV1. These values are used to symmetrically encrypt (sEnc) the password PW to obtain an encrypted password shown as EP. An example symmetric encryption scheme is AES encryption. The browser 22 also asymmetrically encrypts (aEnc) the symmetric key sK1 under pbK1 to obtain an encrypted key shown as EK. Finally, the browser 22 sends EP, EK and IV1 along with the login form to the application store 22.
[0027] The application store 50 responds to receipt of the login form by generating a user validation request message shown as VAL-REQ, including EK, EP and IV1, and sending it to the cloud services agent 60 via the DDC 52 as shown.
[0028] The cloud services agent 60 decrypts (aDec) the encrypted key EK using its own private key prK1 to obtain the symmetric key sK1, then decrypts (sDec) the encrypted password EP using sK1 and IV1 to recover the clear text password PW. The cloud services agent 60 then validates the user credentials by performing a login operation with the directory service 66, which returns "security identifiers" or SIDs that serve as internal identifiers of the user account(s) within the enterprise network 16. As generally known, SIDs are data structures having values that are globally unique across systems, accounts, and users, as well as time (i.e., they are not reused). The cloud services agent 60 returns a validation response VAL-RESP including the SIDs to the application store 50 via the DDC 52.
[0029] The application store 50 saves the SIDs, encrypted key EK, encrypted password EP, and initialization vector IV1 in secure local storage for later use. It also returns an indication of a successful login to the browser 22, which uses the indication to notify the user accordingly. At this point the user may inquire about available applications or services, which are referred to as "resources". The application store 50 requests application data from the DDC 52, and upon receiving it forwards it to the browser 22 where it may be displayed or otherwise provided to the user.
[0030] It will be appreciated that by the above process the clear text password PW does not flow through the cloud network 12, and thus security is enhanced. Only the cloud services agent 60 can decrypt the password to authenticate the user with the directory service 66.
[0031] Figure 7 describes operation at a later time when a user initiates or "launches" an application or desktop. This may occur when a user clicks on a hyperlink for the application/desktop, for example. The browser 22 responds by sending a launch message to the application store 50, which looks up the values EP, EK, and IV1 and sends them to the DDC 52 as part of a "request address" (REQ ADDR) message to prepare a new session. The DDC 52 forwards this information to the cloud services agent 60 as part of a prepare session (PREP SESSION) message.
[0032] As at login time as described above, the cloud services agent 60 decrypts the encrypted key EK and the encrypted password EP to recover the clear text password PW. The cloud services agent 60 then generates a second symmetric key sK2 and another random initialization vector IV2. It re-encrypts the password using the symmetric key sK2 to generate an encrypted password E. It also calculates a hash H of the symmetric key sK2, e.g., a SHA-256 hash. It then sends a prepare session (PREP SESSION) message to the VDA 64 containing H, E and IV2. In alternative embodiments an alternative type of cryptographic function may be applied to sK2 to generate an alternative cryptographic value in place of the hash H.
[0033] The VDA 64 stores the encrypted password E and initialization vector IV2 in association with the hash H, and returns a VDA address (VDA ADDR) message to the cloud services agent 60 that includes a second public key pbK2. This is the public key from a private/public key pair of the VDA 64.
[0034] The cloud services agent 60 encrypts (aEnc) the symmetric key using the VDA public key pbK2 to generate a data value referred to as the C-S agent ticket (CSA-T), and sends this to the application store 50 (via the DDC 52) as part of a VDA ADDR message containing the VDA address returned by the VDA 64.
[0035] The application store 50 first obtains a second ticket, shown as STA-T, by requesting it from the STA 54. It then sends a connection file (CONN FILE) to the browser 22 that contains an identifier of the gateway (GW) and the two tickets CSA-T and STA-T.
[0036] The browser 22 browser invokes the R-D engine 26 with the connection file to enable the R-D engine 26 to connect to the VDA 64 using CSA-T as its authorization. The R-D engine 26 creates a connection request message CONNECT including CSA-T and STA-T and sends it to the gateway 62. The gateway 62 obtains the VDA address from the STA 54, then issues a corresponding CONNECT message to the VDA 64 that includes CSA-T.
[0037] The VDA 64 decrypts (aDec) the CSA-T value using its private key prK2 to obtain the symmetric key sK2, and calculates the hash of sK2. It compares the calculated hash with the stored hash value H it received from the cloud services agent 60, and proceeds further with connection establishment only if these hash values match. Assuming a match, the VDA 64 then looks up the stored values E and IV2 using H, and then decrypts (sDec) the encrypted password E using the symmetric key sK2 and initialization vector IV2. The recovered password PW is provided to the directory services 66 to initiate a new session at the operating system level, and a response is returned to the R-D engine 26 indicating successful establishment of the session. At this point other application logic takes over to enable the user to access and utilize the virtualized desktop provided by the VDA 64.
[0038] The above process ensures that the encrypted password does not flow back to the browser 22, and that only a one-time ticket CSA-T is sent back to the R-D engine 26. In addition to preventing the same encrypted password from flowing forward and backward between the browser 22 and the cloud services, the illustrated technique also adds asymmetric encryption for the symmetric key sK2 to ensure that the ticket CSA-T travelling through the cloud services cannot be directly used to decrypt the re-encrypted password E.
[0039] Figures 8 and 9 illustrate operations of the application store 50 and cloud services agent 60 respectively in connection with the overall schemes of Figures 6 and 7. The description below employs general language along with parentheticals to associate the general terms with examples from the embodiments (e.g., Figures 6-7) herein.
[0040] As shown in Figure 8, at 70 the application store 50 operates in the login phase (Figure 6), performing a first user authentication for a user of the client computer 10 and receiving security identifiers (SIDs) from a trusted computing network (enterprise network 16), the security identifiers identifying the user as an authorized user of the trusted computing network. The first user authentication includes (1) transmitting a public key (pbK1) of a private/public key pair of the trusted computing network to the client computer and (2) subsequently receiving from the client computer and transmitting to the trusted computing network an encrypted password and encrypted key (EP, EK), the encrypted password being a user password (PW) encrypted under a first one-use symmetric key (sK1), the encrypted key being the first one-use symmetric key encrypted under the public key. These values are forwarded to the trusted computing network, which decrypts (aDec) the encrypted key and decrypts (sDec) the encrypted password to obtain the user password for authenticating the user and returning the security identifiers to the enterprise application store.
[0041] At 72, in a subsequent application launch phase (Figure 7), a second user authentication is performed as part of establishing a connection to the enterprise application. The second user authentication includes (1) transmitting the encrypted password and encrypted key (EP, EK) to the trusted computing network and (2) subsequently receiving from the trusted computing network and transmitting to the client computer a login ticket (CSA-T), the login ticket including a second one-use symmetric key (sK2) under which the user password is encrypted and stored in encrypted form within the trusted computing network. The client computer subsequently transmits a connection-establishment message including the login ticket to the trusted computing network. The trusted computing network decrypts the encrypted form using the second one-use symmetric key from the login ticket of the connection-establishment message to obtain the user password for authenticating the user and establishing the connection of the client computer to the enterprise application. In one embodiment, operation at 72 may also include the asymmetric encryption and decryption of the symmetric key sK2 using another private/public key pair (prK2, pbK2) of the trusted computing network.
[0042] As shown in Figure 9, at 80 the cloud services agent 60 operates in a login phase (Figure 6), performing a first user authentication for a user of the client computer and receiving and forwarding security identifiers to an enterprise application store executing in the untrusted cloud computing network, the security identifiers identifying the user as an authorized user of the trusted computing network. The first user authentication includes (1) receiving a validation request for the user, the validation request including an encrypted password (EP) and an encrypted key (EK), the encrypted password being a user password of the user encrypted under a first one-use symmetric key (sK1), the encrypted key being the first one-use symmetric key encrypted under a public key (prK1) of a private/public key pair of the cloud services agent, and (2) decrypting the encrypted key and the encrypted password to obtain the user password, and performing a local login operation in the trusted computing network to authenticate the user and return the security identifiers to the enterprise application store.
[0043] At 82, in a subsequent application launch phase (Figure 7), a second user authentication is performed as part of establishing the connection to the enterprise application. The second user authentication includes (1) receiving the encrypted password and the encrypted key from the enterprise application store and decrypting the encrypted key and encrypted password to obtain the user password, (2) re-encrypting the user password under a second one-use symmetric key (sK2) to generate a second encrypted password (E), and calculating a cryptographic function (e.g., hash) of the second one-use symmetric key to generate a cryptographic value (H), (3) forwarding the second encrypted password and cryptographic value to an application delivery agent (VDA) of the trusted computing network for subsequent use in confirming authenticity of a subsequent connection request from the client computer, and (4) sending a login ticket (CSA-T) to the enterprise application store, the login ticket including the second symmetric key to enable the client computer to include a reference to the second encrypted password and cryptographic value in the subsequent connection request to the application delivery agent. In Figure 7 the second symmetric key is asymmetrically encrypted before being included in the login ticket, which provides additional security but may not be required in all embodiments.
[0044] As noted above with reference to Figure 6, in an alternative embodiment an additional step could be used in which the browser 22 verifies that pbK1 belongs to the intended organization before forwarding the encrypted password to the cloud network.
[0045] In this case, the pbK1 is sent to the browser as part of a digital X.509 certificate which is issued to the owner organization (for example the company which owns the on-premises services and is renting the cloud services from a cloud service provider). The digital certificate contains pbK1 and the name of the organization issued to. Alternatively the certificate may be signed by a trusted certificate authority (or a certificate chain ending in a trusted certificate authority). Alternatively it may be self-signed. This certificate might be similar in form to an SSL website certificate or a digital certificate belonging to an email sender, but in this case it belongs to the organization which owns the asymmetric key pair pbK1/prK1 and identifies that organization in the Distinguished Name within the certificate.
[0046] The browser 22 then validates that the organization identified in the certificate is trusted (that the certificate belongs to the organization the user is logging into via the app store) before using the associated pkB1 to encrypt the user's password.
[0047] The verification may include that the certificate chain ends in a trusted Root CA along with the normal certificate chain validations, that the digital certificate belongs to the expected organization, or that the fingerprint of a self-signed certificate matches an expected value.
[0048] The verification could occur by displaying the Distinguished Name including the organization the certificate was issued to the user who then verifies this is the intended organization before entering their credentials, alternatively the user could be shown the fingerprint of the self-signed certificate and manually verify this against the expected value before proceeding. Alternatively the verification check could be performed automatically via policy configuration stored in the Browser via LocalStorage or retrieved from a trusted URL which policy may contain the fingerprint of a trusted self-signed certificate, or the expected Distinguished Name including the organization that the certificate was issued to as part of a certificate chain ending in a trusted root certificate authority.
in a login phase (70), performing a first user authentication for a user of the client computer and receiving security identifiers from the enterprise network, the security identifiers identifying the user as an authorized user of the enterprise network, the first user authentication including transmitting a public key of a private/public key pair of the enterprise network to the client computer and subsequently receiving from the client computer and transmitting to the enterprise network an encrypted password and encrypted key, the encrypted password being a user password encrypted under a first one-use symmetric key, the encrypted key being the first one-use symmetric key encrypted under the public key, the enterprise network decrypting the encrypted key and the encrypted password to obtain the user password for authenticating the user and returning the security identifiers to the enterprise application store; and
in a subsequent application launch phase (72), performing a second user authentication as part of establishing the connection to the enterprise application, the second user authentication including transmitting the encrypted password and encrypted key to the enterprise network and subsequently receiving from the enterprise network and transmitting to the client computer a login ticket, the login ticket including a second one-use symmetric key under which the user password is encrypted and stored in encrypted form within the enterprise network, the client computer subsequently transmitting a connection-establishment message including the login ticket to the enterprise network, the enterprise network decrypting the encrypted form using the second one-use symmetric key from the login ticket of the connection-establishment message to obtain the user password for authenticating the user and establishing the connection of the client computer to the enterprise application.
the second user authentication in the application launch phase includes obtaining a second login ticket from a ticket authority of the cloud network and transmitting the second login ticket to the client computer;
the connection-establishment message is transmitted to a gateway of the enterprise network which uses the second login ticket in an exchange with the ticket authority to obtain an address for a virtual desktop agent of the enterprise network to which the connection-establishment message is to be sent, and subsequently sends the connection-establishment message to the virtual desktop agent.
in a login phase (80), performing a first user authentication for a user of the client computer and receiving and forwarding security identifiers to an enterprise application store executing in the cloud network, the security identifiers identifying the user as an authorized user of the enterprise network, the first user authentication including receiving a validation request for the user, the validation request including an encrypted password and an encrypted key, the encrypted password being a user password of the user encrypted under a first one-use symmetric key, the encrypted key being the first one-use symmetric key encrypted under a public key of a private/public key pair of the cloud services agent, and decrypting the encrypted key and the encrypted password to obtain the user password and performing a local login operation in the enterprise network to authenticate the user and return the security identifiers to the enterprise application store; and
in a subsequent application launch phase (82), performing a second user authentication as part of establishing the connection to the enterprise application, the second user authentication including receiving the encrypted password and the encrypted key from the enterprise application store and decrypting the encrypted key and encrypted password to obtain the user password, re-encrypting the user password under a second one-use symmetric key to generate a second encrypted password, and calculating a cryptographic function of the second one-use symmetric key to generate a cryptographic value, forwarding the second encrypted password and cryptographic value to an application delivery agent of the enterprise network for subsequent use in confirming authenticity of a subsequent connection request from the client computer, and sending a login ticket to the enterprise application store, the login ticket including the second symmetric key to enable the client computer to include a reference to the second encrypted password and cryptographic value in the subsequent connection request to the application delivery agent.
interface circuitry (34) providing interfaces to the client computer and to the enterprise network; and
processing circuitry (30) storing and executing computer program instructions to cause the special-purpose computer to:
in a login phase (70), perform a first user authentication for a user of the client computer and receive security identifiers from the enterprise network, the security identifiers identifying the user as an authorized user of the enterprise network, the first user authentication including transmitting a public key of a private/public key pair of the enterprise network to the client computer and subsequently receiving from the client computer and transmitting to the enterprise network an encrypted password and encrypted key, the encrypted password being a user password encrypted under a first one-use symmetric key, the encrypted key being the first one-use symmetric key encrypted under the public key, the enterprise network decrypting the encrypted key and the encrypted password to obtain the user password for authenticating the user and returning the security identifiers to the enterprise application store; and
in a subsequent application launch phase (72), perform a second user authentication as part of establishing the connection to the enterprise application, the second user authentication including transmitting the encrypted password and encrypted key to the enterprise network and subsequently receiving from the enterprise network and transmitting to the client computer a login ticket, the login ticket including a second one-use symmetric key under which the user password is encrypted and stored in encrypted form within the enterprise network, the client computer subsequently transmitting a connection-establishment message including the login ticket to the enterprise network, the enterprise network decrypting the encrypted form using the second one-use symmetric key from the login ticket of the connection-establishment message to obtain the user password for authenticating the user and establishing the connection of the client computer to the enterprise application.
the second user authentication in the application launch phase includes obtaining a second login ticket from a ticket authority of the cloud network and transmitting the second login ticket to the client computer;
the connection-establishment message is transmitted to a gateway of the enterprise network which uses the second login ticket in an exchange with the ticket authority to obtain an address for a virtual desktop agent of the enterprise network to which the connection-establishment message is to be sent, and subsequently sends the connection-establishment message to the virtual desktop agent.
interface circuitry (34) providing interfaces to the client computer and to the enterprise network; and
processing circuitry (30) storing and executing computer program instructions to cause the special-purpose computer to:
in a login phase (80), perform a first user authentication for a user of the client computer and receive and forward security identifiers to an enterprise application store executing in the cloud network, the security identifiers identifying the user as an authorized user of the enterprise network, the first user authentication including receiving a validation request for the user, the validation request including an encrypted password and an encrypted key, the encrypted password being a user password of the user encrypted under a first one-use symmetric key, the encrypted key being the first one-use symmetric key encrypted under a public key of a private/public key pair of the cloud services agent, and decrypting the encrypted key and the encrypted password to obtain the user password and performing a local login operation in the enterprise network to authenticate the user and return the security identifiers to the enterprise application store; and
in a subsequent application launch phase (82), perform a second user authentication as part of establishing the connection to the enterprise application, the second user authentication including receiving the encrypted password and the encrypted key from the enterprise application store and decrypting the encrypted key and encrypted password to obtain the user password, re-encrypting the user password under a second one-use symmetric key to generate a second encrypted password, and calculating a cryptographic function of the second one-use symmetric key to generate a cryptographic value, forwarding the second encrypted password and cryptographic value to an application delivery agent of the enterprise network for subsequent use in confirming authenticity of a subsequent connection request from the client computer, and sending a login ticket to the enterprise application store, the login ticket including the second symmetric key to enable the client computer to include a reference to the second encrypted password and cryptographic value in the subsequent connection request to the application delivery agent.
in einer Login-Phase (70), Durchführen einer ersten Benutzerauthentifizierung für einen Benutzer des Client-Computers und Empfangen von Sicherheitskennungen aus dem Unternehmensnetzwerk, wobei die Sicherheitskennungen den Benutzer als einen autorisierten Benutzer des Unternehmensnetzwerks identifizieren, wobei die erste Benutzerauthentifizierung ein Senden eines öffentlichen Schlüssels eines privaten/öffentlichen Schlüsselpaares des Unternehmensnetzwerks an den Client-Computer und ein anschließendes Empfangen und Senden eines verschlüsselten Passworts und eines verschlüsselten Schlüssels vom Client-Computer an das Unternehmensnetzwerk enthält, wobei das verschlüsselte Passwort ein Benutzer-Passwort ist, das unter einem ersten symmetrischen Einweg-Schlüssel verschlüsselt wird, wobei der verschlüsselte Schlüssel der erste symmetrische Einweg-Schlüssel ist, der unter dem öffentlichen Schlüssel verschlüsselt wird, wobei das Unternehmensnetzwerk den verschlüsselten Schlüssel und das verschlüsselte Passwort entschlüsselt, um das Benutzer-Passwort zum Authentifizieren des Benutzers zu erhalten, und die Sicherheitskennungen an den Unternehmensanwendungsspeicher zurückgibt; und
in einer anschließenden Anwendungsstartphase (72), Durchführen einer zweiten Benutzerauthentifizierung als Teil des Einrichtens der Verbindung mit der Unternehmensanwendung, wobei die zweite Benutzerauthentifizierung ein Senden des verschlüsselten Passworts und des verschlüsselten Schlüssels an das Unternehmensnetzwerk und ein anschließendes Empfangen und Senden eines Login-Tickets vom Unternehmensnetzwerk an den Client-Computer enthält, wobei das Login-Ticket einen zweiten symmetrischen Einweg-Schlüssel enthält, unter dem das Benutzer-Passwort verschlüsselt und in verschlüsselter Form im Unternehmensnetzwerk gespeichert wird, wobei der Client-Computer anschließend eine das Login-Ticket enthaltende Verbindungsaufbau-Nachricht an das Unternehmensnetzwerk sendet, wobei das Unternehmensnetzwerk die verschlüsselte Form unter Verwendung des zweiten symmetrischen Einweg-Schlüssels aus dem Login-Ticket der Verbindungsaufbau-Nachricht entschlüsselt, um das Benutzer-Passwort zur Authentifizierung des Benutzers zu erhalten, und die Verbindung des Client-Computers mit der Unternehmensanwendung einrichtet.
die zweite Benutzerauthentifizierung in der Anwendungsstartphase ein Erhalten eines zweiten Login-Tickets von einer Ticket-Autorität des Cloud-Netzwerks und ein Senden des zweiten Login-Tickets an den Client-Computer enthält;
die Verbindungsaufbau-Nachricht an ein Gateway des Unternehmensnetzwerks gesendet wird, welches das zweite Login-Ticket in einem Austausch mit der Ticket-Autorität verwendet, um eine Adresse für einen Virtual-Desktop-Agenten des Unternehmensnetzwerks zu erhalten, an welche die Verbindungsaufbau-Nachricht gesendet werden soll, und anschließend die Verbindungsaufbau-Nachricht an den Virtual Desktop-Agenten sendet.
in einer Login-Phase (80), Durchführen einer ersten Benutzerauthentifizierung für einen Benutzer des Client-Computers und Empfangen und Weiterleiten von Sicherheitskennungen an einen im Cloud-Netzwerk ausgeführten Unternehmensanwendungsspeicher, wobei die Sicherheitskennungen den Benutzer als einen autorisierten Benutzer des Unternehmensnetzwerks identifizieren, wobei die erste Benutzerauthentifizierung ein Empfangen einer Validierungsanfrage für den Benutzer, wobei die Validierungsanfrage ein verschlüsseltes Passwort und einen verschlüsselten Schlüssel enthält, wobei das verschlüsselte Passwort ein Benutzer-Passwort ist, das unter einem ersten symmetrischen Einweg-Schlüssel verschlüsselt wird, wobei der verschlüsselte Schlüssel der erste symmetrische Einweg-Schlüssel ist, der unter einem öffentlichen Schlüssel eines privaten/ öffentlichen Schlüsselpaares des Cloud-Service-Agenten verschlüsselt wird, und ein Entschlüsseln des verschlüsselten Schlüssels und des verschlüsselten Passworts, um das Benutzer-Passwort zu erhalten, und ein Durchführen eines lokalen Login-Vorgangs im Unternehmensnetzwerk, um den Benutzer zu authentifizieren und die Sicherheitskennungen an den Unternehmensanwendungsspeicher zurückzugeben, enthält; und
in einer anschließenden Anwendungsstartphase (82), Durchführen einer zweiten Benutzerauthentifizierung als Teil des Einrichtens der Verbindung mit der Unternehmensanwendung, wobei die zweite Benutzerauthentifizierung ein Empfangen des verschlüsselten Passworts und des verschlüsselten Schlüssels vom Unternehmensanwendungsspeicher und ein Entschlüsseln des verschlüsselten Schlüssels und des verschlüsselten Passworts, um das Benutzer-Passwort zu erhalten, ein Wiederverschlüsseln des Benutzer-Passworts unter einem zweiten symmetrischen Einweg-Schlüssel, um ein zweites verschlüsseltes Passwort zu erzeugen, und ein Berechnen einer kryptografischen Funktion des zweiten symmetrischen Einweg-Schlüssels, um einen kryptografischen Wert zu erzeugen, ein Weiterleiten des zweiten verschlüsselten Passworts und des kryptografischen Werts an einen Anwendungslieferagenten des Unternehmensnetzwerks zur anschließenden Verwendung beim Bestätigen der Authentizität einer anschließenden Verbindungsanfrage vom Client-Computer und ein Senden eines Login-Tickets an den Unternehmensanwendungsspeicher, wobei das Login-Ticket den zweiten symmetrischen Schlüssel enthält, um es dem Client-Computer zu ermöglichen, einen Verweis auf das zweite verschlüsselte Passwort und den kryptografischen Wert in die anschließende Verbindungsanfrage an den Anwendungslieferagenten einzufügen, enthält.
eine Schnittstellenschaltung (34), die Schnittstellen zum Client-Computer und zum Unternehmensnetzwerk bereitstellt; und
eine Verarbeitungsschaltung (30), die Computerprogrammanweisungen speichert und ausführt, um den Spezialcomputer zu veranlassen:
in einer Login-Phase (70) eine erste Benutzerauthentifizierung für einen Benutzer des Client-Computers durchzuführen und Sicherheitskennungen aus dem Unternehmensnetzwerk zu empfangen, wobei die Sicherheitskennungen den Benutzer als einen autorisierten Benutzer des Unternehmensnetzwerks identifizieren, wobei die erste Benutzerauthentifizierung ein Senden eines öffentlichen Schlüssels eines privaten/öffentlichen Schlüsselpaares des Unternehmensnetzwerks an den Client-Computer und ein anschließendes Empfangen und Senden eines verschlüsselten Passworts und eines verschlüsselten Schlüssels vom Client-Computer an das Unternehmensnetzwerk enthält, wobei das verschlüsselte Passwort ein Benutzer-Passwort ist, das unter einem ersten symmetrischen Einweg-Schlüssel verschlüsselt wird, wobei der verschlüsselte Schlüssel der erste symmetrische Einweg-Schlüssel ist, der unter dem öffentlichen Schlüssel verschlüsselt wird, wobei das Unternehmensnetzwerk den verschlüsselten Schlüssel und das verschlüsselte Passwort entschlüsselt, um das Benutzer-Passwort zum Authentifizieren des Benutzers zu erhalten, und die Sicherheitskennungen an den Unternehmensanwendungsspeicher zurückgibt; und
in einer anschließenden Anwendungsstartphase (72) eine zweite Benutzerauthentifizierung als Teil des Einrichtens der Verbindung mit der Unternehmensanwendung durchführt, wobei die zweite Benutzerauthentifizierung ein Senden des verschlüsselten Passworts und des verschlüsselten Schlüssels an das Unternehmensnetzwerk und ein anschließendes Empfangen und Senden eines Login-Tickets vom Unternehmensnetzwerk an den Client-Computer enthält, wobei das Login-Ticket einen zweiten symmetrischen Einweg-Schlüssel enthält, unter dem das Benutzer-Passwort verschlüsselt und in verschlüsselter Form im Unternehmensnetzwerk gespeichert wird, wobei der Client-Computer anschließend eine das Login-Ticket enthaltende Verbindungsaufbau-Nachricht an das Unternehmensnetzwerk sendet, wobei das Unternehmensnetzwerk die verschlüsselte Form unter Verwendung des zweiten symmetrischen Einweg-Schlüssels aus dem Login-Ticket der Verbindungsaufbau-Nachricht entschlüsselt, um das Benutzer-Passwort zur Authentifizierung des Benutzers zu erhalten, und die Verbindung des Client-Computers mit der Unternehmensanwendung einrichtet.
die zweite Benutzerauthentifizierung in der Anwendungsstartphase ein Erhalten eines zweiten Login-Tickets von einer Ticket-Autorität des Cloud-Netzwerks und ein Senden des zweiten Login-Tickets an den Client-Computer enthält;
die Verbindungsaufbau-Nachricht an ein Gateway des Unternehmensnetzwerks gesendet wird, welches das zweite Login-Ticket in einem Austausch mit der Ticket-Autorität verwendet, um eine Adresse für einen Virtual-Desktop-Agenten des Unternehmensnetzwerks zu erhalten, an welche die Verbindungsaufbau-Nachricht gesendet werden soll, und anschließend die Verbindungsaufbau-Nachricht an den Virtual Desktop-Agenten sendet.
eine Schnittstellenschaltung (34), die Schnittstellen zum Client-Computer und zum Unternehmensnetzwerk bereitstellt; und
eine Verarbeitungsschaltung (30), die Computerprogrammanweisungen speichert und ausführt, um den Spezialcomputer zu veranlassen:
in einer Login-Phase (80) eine erste Benutzerauthentifizierung für einen Benutzer des Client-Computers durchzuführen und Sicherheitskennungen zu empfangen und an einen im Cloud-Netzwerk ausgeführten Unternehmensanwendungsspeicher weiterzuleiten, wobei die Sicherheitskennungen den Benutzer als einen autorisierten Benutzer des Unternehmensnetzwerks identifizieren, wobei die erste Benutzerauthentifizierung ein Empfangen einer Validierungsanfrage für den Benutzer, wobei die Validierungsanfrage ein verschlüsseltes Passwort und einen verschlüsselten Schlüssel enthält, wobei das verschlüsselte Passwort ein Benutzer-Passwort ist, das unter einem ersten symmetrischen Einweg-Schlüssel verschlüsselt wird, wobei der verschlüsselte Schlüssel der erste symmetrische Einweg-Schlüssel ist, der unter einem öffentlichen Schlüssel eines privaten/öffentlichen Schlüsselpaares des Cloud-Service-Agenten verschlüsselt wird, und ein Entschlüsseln des verschlüsselten Schlüssels und des verschlüsselten Passworts, um das Benutzer-Passwort zu erhalten, und ein Durchführen eines lokalen Login-Vorgangs im Unternehmensnetzwerk, um den Benutzer zu authentifizieren und die Sicherheitskennungen an den Unternehmensanwendungsspeicher zurückzugeben, enthält; und
in einer anschließenden Anwendungsstartphase (82) eine zweite Benutzerauthentifizierung als Teil des Einrichtens der Verbindung mit der Unternehmensanwendung durchzuführen, wobei die zweite Benutzerauthentifizierung ein Empfangen des verschlüsselten Passworts und des verschlüsselten Schlüssels vom Unternehmensanwendungsspeicher und ein Entschlüsseln des verschlüsselten Schlüssels und des verschlüsselten Passworts, um das Benutzer-Passwort zu erhalten, ein Wiederverschlüsseln des Benutzer-Passworts unter einem zweiten symmetrischen Einweg-Schlüssel, um ein zweites verschlüsseltes Passwort zu erzeugen, und ein Berechnen einer kryptografischen Funktion des zweiten symmetrischen Einweg-Schlüssels, um einen kryptografischen Wert zu erzeugen, ein Weiterleiten des zweiten verschlüsselten Passworts und des kryptografischen Werts an einen Anwendungslieferagenten des Unternehmensnetzwerks zur anschließenden Verwendung beim Bestätigen der Authentizität einer anschließenden Verbindungsanfrage vom Client-Computer und ein Senden eines Login-Tickets an den Unternehmensanwendungsspeicher, wobei das Login-Ticket den zweiten symmetrischen Schlüssel enthält, um es dem Client-Computer zu ermöglichen, einen Verweis auf das zweite verschlüsselte Passwort und den kryptografischen Wert in die anschließende Verbindungsanfrage an den Anwendungslieferagenten einzufügen, enthält.
dans une phase de connexion (70), effectuer une première authentification d'utilisateur pour un utilisateur de l'ordinateur client, et recevoir des identifiants de sécurité de la part du réseau d'entreprise, les identifiants de sécurité identifiant l'utilisateur comme un utilisateur autorisé du réseau d'entreprise, la première authentification d'utilisateur consistant à transmettre une clé publique d'une paire de clés privée / publique du réseau d'entreprise à l'ordinateur client, et ultérieurement à recevoir de la part de l'ordinateur client et à transmettre au réseau d'entreprise, un mot de passe chiffré et une clé chiffrée, le mot de passe chiffré étant un mot de passe d'utilisateur qui est chiffré au moyen d'une première clé symétrique à usage unique, la clé chiffrée étant la première clé symétrique à usage unique qui est chiffrée au moyen de la clé publique, le réseau d'entreprise déchiffrant la clé chiffrée et le mot de passe chiffré pour obtenir le mot de passe d'utilisateur servant à authentifier l'utilisateur et à renvoyer les identifiants de sécurité au magasin d'applications d'entreprise ; et
dans une phase de lancement d'application ultérieure (72), effectuer une deuxième authentification d'utilisateur dans le cadre de l'établissement de la connexion à l'application d'entreprise, la deuxième authentification d'utilisateur consistant à transmettre le mot de passe chiffré et la clé chiffrée au réseau d'entreprise, et ultérieurement à recevoir de la part du réseau d'entreprise et à transmettre à l'ordinateur client, un ticket de connexion, le ticket de connexion incluant une deuxième clé symétrique à usage unique au moyen de laquelle le mot de passe d'utilisateur est chiffré et stocké sous forme chiffrée au sein du réseau d'entreprise, l'ordinateur client transmettant ultérieurement un message d'établissement de connexion incluant le ticket de connexion au réseau d'entreprise, le réseau d'entreprise déchiffrant la forme chiffrée à l'aide de la deuxième clé symétrique à usage unique provenant du ticket de connexion du message d'établissement de connexion, pour obtenir le mot de passe d'utilisateur servant à authentifier l'utilisateur et à établir la connexion de l'ordinateur client à l'application d'entreprise.
la deuxième authentification d'utilisateur dans la phase de lancement d'application consiste à obtenir un deuxième ticket de connexion auprès d'une autorité de ticket du réseau Cloud, et à transmettre le deuxième ticket de connexion à l'ordinateur client ;
le message d'établissement de connexion est transmis à une passerelle du réseau d'entreprise, laquelle utilise le deuxième ticket de connexion lors d'un échange avec l'autorité de ticket pour obtenir une adresse pour un agent de bureau virtuel du réseau d'entreprise auquel le message d'établissement de connexion doit être envoyé, et envoie ultérieurement le message d'établissement de connexion à l'agent de bureau virtuel.
dans une phase de connexion (80), effectuer une première authentification d'utilisateur pour un utilisateur de l'ordinateur client, et recevoir des identifiants de sécurité et les transmettre vers un magasin d'applications d'entreprise s'exécutant dans le réseau Cloud, les identifiants de sécurité identifiant l'utilisateur en tant qu'un utilisateur autorisé du réseau d'entreprise, la première authentification d'utilisateur consistant à recevoir une demande de validation pour l'utilisateur, la demande de validation incluant un mot de passe chiffré et une clé chiffrée, le mot de passe chiffré étant un mot de passe d'utilisateur qui est chiffré au moyen d'une première clé symétrique à usage unique, la clé chiffrée étant la première clé symétrique à usage unique qui est chiffrée au moyen d'une clé publique d'une paire de clés privée / publique de l'agent de services Cloud, et déchiffrer la clé chiffrée et le mot de passe chiffré pour obtenir le mot de passe d'utilisateur, et effectuer une opération de connexion locale dans le réseau d'entreprise pour authentifier l'utilisateur et renvoyer les identifiants de sécurité au magasin d'applications d'entreprise ; et
dans une phase de lancement d'application ultérieure (82), effectuer une deuxième authentification d'utilisateur dans le cadre de l'établissement de la connexion à l'application d'entreprise, la deuxième authentification d'utilisateur consistant à recevoir le mot de passe chiffré et la clé chiffrée de la part du magasin d'applications d'entreprise et à déchiffrer la clé chiffrée et le mot de passe chiffré pour obtenir le mot de passe d'utilisateur, chiffrer de nouveau le mot de passe d'utilisateur au moyen d'une deuxième clé symétrique à usage unique pour générer un deuxième mot de passe chiffré, et calculer une fonction cryptographique de la deuxième clé symétrique à usage unique pour générer une valeur cryptographique, transmettre le deuxième mot de passe chiffré et la valeur cryptographique à un agent de distribution d'applications du réseau d'entreprise pour une utilisation ultérieure dans la confirmation de l'authenticité d'une demande de connexion ultérieure de la part de l'ordinateur client, et envoyer un ticket de connexion au magasin d'applications d'entreprise, le ticket de connexion incluant la deuxième clé symétrique pour permettre à l'ordinateur client d'inclure une référence au deuxième mot de passe chiffré et à la valeur cryptographique dans la demande de connexion ultérieure auprès de l'agent de distribution d'applications.
des circuits d'interface (34) fournissant des interfaces à l'ordinateur client et au réseau d'entreprise ; et
des circuits de traitement (30) stockant et exécutant des instructions de programme informatique pour permettre à l'ordinateur à usage particulier de :
dans une phase de connexion (70), effectuer une première authentification d'utilisateur pour un utilisateur de l'ordinateur client, et recevoir des identifiants de sécurité de la part du réseau d'entreprise, les identifiants de sécurité identifiant l'utilisateur comme un utilisateur autorisé du réseau d'entreprise, la première authentification d'utilisateur consistant à transmettre une clé publique d'une paire de clés privée / publique du réseau d'entreprise à l'ordinateur client, et ultérieurement à recevoir de la part de l'ordinateur client et à transmettre au réseau d'entreprise, un mot de passe chiffré et une clé chiffrée, le mot de passe chiffré étant un mot de passe d'utilisateur qui est chiffré au moyen d'une première clé symétrique à usage unique, la clé chiffrée étant la première clé symétrique à usage unique qui est chiffrée au moyen de la clé publique, le réseau d'entreprise déchiffrant la clé chiffrée et le mot de passe chiffré pour obtenir le mot de passe d'utilisateur servant à authentifier l'utilisateur et à renvoyer les identifiants de sécurité au magasin d'applications d'entreprise ; et
dans une phase de lancement d'application ultérieure (72), effectuer une deuxième authentification d'utilisateur dans le cadre de l'établissement de la connexion à l'application d'entreprise, la deuxième authentification d'utilisateur consistant à transmettre le mot de passe chiffré et la clé chiffrée au réseau d'entreprise, et ultérieurement à recevoir de la part du réseau d'entreprise et à transmettre à l'ordinateur client, un ticket de connexion, le ticket de connexion incluant une deuxième clé symétrique à usage unique au moyen de laquelle le mot de passe d'utilisateur est chiffré et stocké sous forme chiffrée au sein du réseau d'entreprise, l'ordinateur client transmettant ultérieurement un message d'établissement de connexion incluant le ticket de connexion au réseau d'entreprise, le réseau d'entreprise déchiffrant la forme chiffrée à l'aide de la deuxième clé symétrique à usage unique provenant du ticket de connexion du message d'établissement de connexion pour obtenir le mot de passe d'utilisateur servant à authentifier l'utilisateur et à établir la connexion de l'ordinateur client à l'application d'entreprise.
la deuxième authentification d'utilisateur dans la phase de lancement d'application consiste à obtenir un deuxième ticket de connexion auprès d'une autorité de ticket du réseau Cloud, et à transmettre le deuxième ticket de connexion à l'ordinateur client ;
le message d'établissement de connexion est transmis à une passerelle du réseau d'entreprise, laquelle utilise le deuxième ticket de connexion lors d'un échange avec l'autorité de ticket pour obtenir une adresse pour un agent de bureau virtuel du réseau d'entreprise auquel le message d'établissement de connexion doit être envoyé, et envoie ultérieurement le message d'établissement de connexion à l'agent de bureau virtuel.
des circuits d'interface (34) fournissant des interfaces à l'ordinateur client et au réseau d'entreprise ; et
des circuits de traitement (30) stockant et exécutant des instructions de programme informatique pour permettre à l'ordinateur à usage particulier de :
dans une phase de connexion (80), effectuer une première authentification d'utilisateur pour un utilisateur de l'ordinateur client, et recevoir des identifiants de sécurité et les transmettre vers un magasin d'applications d'entreprise s'exécutant dans le réseau Cloud, les identifiants de sécurité identifiant l'utilisateur en tant qu'un utilisateur autorisé du réseau d'entreprise, la première authentification d'utilisateur consistant à recevoir une demande de validation pour l'utilisateur, la demande de validation incluant un mot de passe chiffré et une clé chiffrée, le mot de passe chiffré étant un mot de passe d'utilisateur qui est chiffré au moyen d'une première clé symétrique à usage unique, la clé chiffrée étant la première clé symétrique à usage unique qui est chiffrée au moyen d'une clé publique d'une paire de clés privée / publique de l'agent de services Cloud, et déchiffrer la clé chiffrée et le mot de passe chiffré pour obtenir le mot de passe d'utilisateur, et effectuer une opération de connexion locale dans le réseau d'entreprise pour authentifier l'utilisateur et renvoyer les identifiants de sécurité au magasin d'applications d'entreprise ; et
dans une phase de lancement d'application ultérieure (82), effectuer une deuxième authentification d'utilisateur dans le cadre de l'établissement de la connexion à l'application d'entreprise, la deuxième authentification d'utilisateur consistant à recevoir le mot de passe chiffré et la clé chiffrée de la part du magasin d'applications d'entreprise et à déchiffrer la clé chiffrée et le mot de passe chiffré pour obtenir le mot de passe d'utilisateur, chiffrer de nouveau le mot de passe d'utilisateur au moyen d'une deuxième clé symétrique à usage unique pour générer un deuxième mot de passe chiffré, et calculer une fonction cryptographique de la deuxième clé symétrique à usage unique pour générer une valeur cryptographique, transmettre le deuxième mot de passe chiffré et la valeur cryptographique à un agent de distribution d'applications du réseau d'entreprise pour une utilisation ultérieure dans la confirmation de l'authenticité d'une demande de connexion ultérieure de la part de l'ordinateur client, et envoyer un ticket de connexion au magasin d'applications d'entreprise, le ticket de connexion incluant la deuxième clé symétrique pour permettre à l'ordinateur client d'inclure une référence au deuxième mot de passe chiffré et à la valeur cryptographique dans la demande de connexion ultérieure auprès de l'agent de distribution d'applications.
REFERENCES CITED IN THE DESCRIPTION
This list of references cited by the applicant is for the reader's convenience only. It does not form part of the European patent document. Even though great care has been taken in compiling the references, errors or omissions cannot be excluded and the EPO disclaims all liability in this regard.
Patent documents cited in the description